Computer systems often contain valuable and/or sensitive information, control access to such information, or play an integral role in securing physical locations and assets. The security of information, assets and locations is only as good as the weakest link in the security chain, so it is important that computers reliably be able to distinguish authorized personnel from impostors. In the past, computer security has largely depended on secret passwords. Unfortunately, users often choose passwords that are easy to guess or that are simple enough to determine via exhaustive search or other means. When passwords of greater complexity are assigned, users may find them hard to remember, so may write them down, thus creating a new, different security vulnerability.
Various approaches have been tried to improve the security of computer systems. For example, in “have something, know something” schemes, a prospective user must know a password (or other secret code) and have (or prove possession of) a physical token such as a key or an identification card. Such schemes usually provide better authentication than passwords alone, but an authorized user can still permit an unauthorized user to use the system simply by giving the token and the secret code to the unauthorized user.
Other authentication methods rely on unique physical characteristics of users to identify authorized users. For example, fingerprints, voice patterns and retinal images have all been used with some success. However, these methods usually require special hardware to implement (e.g. fingerprint or retinal cameras; audio input facilities).
A computer authentication technique that is more secure than simple passwords, more difficult to subvert than token systems, and does not require special hardware facilities may be of value in this field.